Vulnerability · Published Sep 16, 2026 · Assigned by GitHub_M
CVE-2026-86071Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root
Low 3.7
In plain English
A low-severity path traversal in junrar from junrar. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile() validates only the final canonical file path, while LocalFolderExtractor.makeFile() creates intermediate path segments with unchecked mkdir() calls. An entry can therefore make the final path resolve inside the destination while causing intermediate directory creation outside it, enabling filesystem pollution or file-versus-directory squatting that can make later security-sensitive writes fail. The demonstrated impact is directory creation, not unconditional arbitrary file-content write. This issue is fixed in version 7.6.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.github.junrar:junrar | 7.6.1 | GHSA-89m4-43j5-vhhx |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://github.com/junrar/junrar/security/advisories/GHSA-89m4-43j5-vhhx x_refsource_CONFIRM
- https://github.com/junrar/junrar/commit/e6e333b195a1e3ad271a18fd79d8ac1eb5289343 x_refsource_MISC
- https://github.com/junrar/junrar/releases/tag/v7.6.1 x_refsource_MISC